From 0d0f49b3455ae2de7a38a9eed1824c3d94f45f18 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 9 Nov 2026 18:17:11 +0100
Subject: [PATCH] fix(release): make an unsigned release commit when git cannot
 sign

Before committing, release.sh now checks whether git can sign by running
a throwaway signed commit-tree. If that fails, because there is no
user.signingkey or no agent holds the key, the script warns and makes
the release commit with --no-gpg-sign. The success message now says
whether the commit is signed or unsigned. AGENTS.md is updated to match.
---
 AGENTS.md          | 2 +-
 scripts/release.sh | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 28e77cd854..458d524716 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -348,7 +348,7 @@ The summary reads as one sentence with the heading of its section, never in the
 - A push that changes `release.json` publishes a release.
 - NEVER edit `release.json` by hand. `scripts/release.sh` changes it.
 - `scripts/plan-version.sh` shows what the current branch releases. `scripts/plan-version.sh --nightly` shows the next nightly.
-- `scripts/release.sh` is interactive and makes a signed commit. Do not run it, push a release commit, or start the release or nightly workflow yourself. Give the user the commands from `RELEASE.md` for the release type:
+- `scripts/release.sh` is interactive and makes a signed commit, or an unsigned commit when git cannot sign. Do not run it, push a release commit, or start the release or nightly workflow yourself. Give the user the commands from `RELEASE.md` for the release type:
 
 | Release | Branch | Command |
 | --- | --- | --- |
diff --git a/scripts/release.sh b/scripts/release.sh
index 9568414c5b..14a38400ff 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -214,8 +214,13 @@ update_version() {
 
 commit() {
 	git add --all -- "$VERSION_FILE" CHANGELOG.md "$CHANGE_DIRECTORY"
-	git commit --quiet -S --message "feat(release): bump $ARTIFACT version to v$new_version"
-	ok "signed commit $DIM$(git rev-parse --short HEAD)$RESET $(git log -1 --format=%s)"
+	local sign=-S kind=signed
+	if ! git commit-tree -S -m 'release signing check' 'HEAD^{tree}' > /dev/null 2>&1 < /dev/null; then
+		sign=--no-gpg-sign kind=unsigned
+		warn "git cannot sign a commit (no user.signingkey, or no agent that holds the key), the release commit is unsigned"
+	fi
+	git commit --quiet "$sign" --message "feat(release): bump $ARTIFACT version to v$new_version"
+	ok "$kind commit $DIM$(git rev-parse --short HEAD)$RESET $(git log -1 --format=%s)"
 }
 
 push() {